Summary
It was discovered that Django incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2024-45230)
It was discovered that Django incorrectly handled certain email sending
failures. A remote attacker could possibly use this issue to enumerate
user emails by issuing password reset requests and observing the outcomes.
(CVE-2024-45231)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python-django | 2:2.2.12-1ubuntu0.25 |
| Ubuntu · 22.04 LTS 22.04:LTS | python-django | 2:3.2.12-2ubuntu1.14 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-django | 3:4.2.11-1ubuntu1.3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-django | 1:1.11.11-1ubuntu1.21+esm7 |
Vulnerabilities 2
-
High 7.5CVE-2024-45230 EPSS 26%
Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
-
Medium 5.3
Django allows enumeration of user e-mail addresses
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset r…